just realized that these are often automated requests (CORS) so tokens aren't really an option, so I'm +1 on it everything but proxy (as-is)